Article

FCRA Basics: Your Rights Under the Fair Credit Reporting Act

The Fair Credit Reporting Act gives you ten specific protections — from a free file disclosure to a 30-day dispute window to a private right to sue. Here is what each one does, where to find it in the statute, and how to use it when something on your report is wrong.

1 min read

The Fair Credit Reporting Act is the federal law that lets you see what's in your credit file, dispute mistakes, and limit who can pull it. Every credit decision a lender, landlord, insurer, or employer makes starts with information this statute regulates. Knowing what it says is the difference between getting an inaccurate collection removed in a month and watching it sit on your file for seven years.

This guide covers what the FCRA reaches, the ten consumer rights it grants, how the dispute process works on a 30-day clock, how long negative items can legally stay on your report, who's allowed to see the file, and what to do when a right gets violated — with the statutory citation for each.

What the FCRA is and what it covers

The Fair Credit Reporting Act was enacted in 1970 and is (https://www.law.cornell.edu/wex/fair_credit_reporting_act_(fcra)). Two major amendments shape the version in effect today: the Fair and Accurate Credit Transactions Act (FACTA) in 2003, which created the free annual credit report and added identity-theft provisions, and the (https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act), which moved most FCRA rulemaking authority to the Consumer Financial Protection Bureau. The CFPB now implements the Act through Regulation V at 12 CFR 1022.

It covers more than the three nationwide credit bureaus. Equifax, Experian, and TransUnion are in scope, but so are the nationwide specialty consumer reporting agencies — companies that compile medical reports, tenant-screening reports, employment background checks, and check-writing histories. Anyone who furnishes information to one of those agencies is bound by the FCRA's accuracy duties, and anyone who pulls a report to make a decision about you is bound by its permissible-purpose rules. That makes the FCRA the consumer-protection backbone for almost every credit, housing, and employment screening decision in the country.

Your ten core rights under the FCRA

The CFPB's (https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf) lays out the headline list, and the FTC ships a near-identical (https://www.consumer.ftc.gov/sites/default/files/articles/pdf/pdf-0096-fair-credit-reporting-act.pdf). Read together, they describe ten protections you can use directly:

The right to be told when information in your file has been used against you. Lenders who deny your application have to send an adverse-action notice naming the bureau they pulled from.
The right to know what's in your file. The three nationwide bureaus must give you a free disclosure on request — currently available weekly at AnnualCreditReport.com, the only federally authorized source.
The right to your credit score in certain circumstances, such as a mortgage application.
The right to dispute incomplete or inaccurate information.
The right to have inaccurate, incomplete, or unverifiable items corrected or deleted after investigation.
The right to have most outdated negative information removed on a fixed schedule (more on those time limits below).
The right to limit access to your file to entities with a "permissible purpose" under § 604.
The right to give written consent before a report is shared with an employer.
The right to opt out of prescreened credit and insurance offers — by phone at 1-888-5-OPTOUT or online at optoutprescreen.com.
The right to sue for damages when a credit reporting agency, a furnisher, or a user of consumer reports violates the Act.

Two of these rights are frequently misunderstood. Section 609 — the section that template-sellers cite when they promise blanket removal of negative tradelines — is a disclosure right, not a removal tool ((/section-609-letter-myth-what-the-law-actually-does)). And the dispute right under § 611 only reaches items that are inaccurate, incomplete, or unverifiable, not accurate ones. Identity-theft victims and active-duty military get extra rights on top, including one-call fraud alerts and the ability to block fraudulent items after filing an FTC identity-theft report.

How the FCRA dispute process actually works

Section 611 of the FCRA gives you a defined process. You file a dispute with the credit reporting agency — online, by mail, or by phone — and the bureau is required to investigate, generally within 30 days of receiving it. The bureau has to forward your dispute to the furnisher (the original creditor or collector) within five business days, and the furnisher then has to investigate and report back.

Two wrinkles. Submit new documentation mid-investigation and the bureau gets an extra 15 days — 45 total. The bureau can also deem a dispute "frivolous or irrelevant" and refuse to investigate, though that refusal has to be sent in writing within five business days with reasons stated. A well-documented dispute almost never gets that label.

When the investigation ends, the CFPB's Regulation V requires that the bureau correct or delete any inaccurate, incomplete, or unverifiable item, and send you a free copy of the updated file. The FCRA dispute process is separate from the validation process you'd run on a third-party debt collector — validation lives under the FDCPA and uses different remedies. For a recent collection, our (/how-to-write-a-debt-validation-letter-with-template) walks through the FDCPA route in parallel with the FCRA dispute you can file with the bureaus.

How long negative information can stay on your report

The FCRA at § 605 caps how long most negative information can appear on a consumer report. The schedule is:

Most late payments, charge-offs, and collection accounts: seven years from the original delinquency date.
Chapter 7 bankruptcy: ten years from filing.
Chapter 13 bankruptcy: typically seven years from filing under bureau policy, though the FCRA allows up to ten.
Civil judgments and unpaid tax liens: seven years under the statute, though all three nationwide bureaus voluntarily removed them in 2017 and 2018 — a CRA policy decision, not an FCRA mandate.
Hard inquiries: two years.

Our deep dive on (/how-long-do-late-payments-stay-on-a-credit-report) walks through the original-delinquency date and the games furnishers sometimes play with re-aging. What the FCRA does not authorize is removal of accurate, current information — that's the consistent line from the FTC and the CFPB in scam-warning material.

Who can pull your credit and what counts as permissible purpose

Section 604 is the gatekeeper. A credit reporting agency may furnish a consumer report only to entities with one of a defined list of permissible purposes. The most common:

A creditor evaluating a credit application you submitted.
An insurer underwriting a policy you applied for.
An employer — only with your written consent, on a disclosure separate from the job application.
A landlord screening a prospective tenant.
A court order or federal grand-jury subpoena.
Yourself, requesting your own file.

What is not a permissible purpose: curiosity, a personal dispute, a sibling or ex-spouse fishing through your finances. Unauthorized access is itself an FCRA violation under § 1681q. The permissible-purpose rule is also why a hard inquiry shows up every time someone pulls your full credit — the inquiry is the audit trail. If you see one from a company you don't recognize, dispute it under § 611; if it can't be tied to a permissible purpose, the bureau has to remove it.

What to do when an FCRA right is violated

The FCRA gives you two parallel paths when something goes wrong, and you can use both at the same time.

File with the regulator. The CFPB's portal at consumerfinance.gov/complaint forwards your complaint to the company and tracks the response. The FTC takes scam and identity-theft reports at reportfraud.ftc.gov. Your state Attorney General handles state credit-services-act complaints, which often layer additional protections on the FCRA.

Use the private right of action. The FCRA lets you sue a CRA, furnisher, or user of consumer reports in state or federal court. Willful violations under § 1681n carry actual damages, statutory damages of $100 to $1,000 per violation, punitive damages, and attorney's fees. Negligent violations under § 1681o carry actual damages and attorney's fees. The statute of limitations is generally two years from the date you discovered the violation, capped at five years from the violation itself.

Identity-theft victims combine the two: file the FTC identity-theft report, attach it to a § 605B information-block request at each bureau, and use any documented violations as the basis for a civil claim. Our 12-month identity-theft recovery roadmap sequences each step. If running the dispute process yourself feels like too much, a legitimate credit-repair company can do it on your behalf — under the Credit Repair Organizations Act (CROA), they cannot collect a fee until services are performed, must give you a written contract, and must honor a three-day right to cancel.

Frequently Asked Questions

Is the Fair Credit Reporting Act federal or state law?

The FCRA is a federal statute codified at 15 U.S.C. § 1681 et seq. and enforced by the CFPB, FTC, and prudential banking regulators. Many states layer additional credit-reporting protections on top of it, but every consumer reporting agency operating in the U.S. has to follow the federal floor.

How many free credit reports does the FCRA actually entitle you to?

The FCRA originally guaranteed one free disclosure per year from each nationwide CRA. Since 2023, all three bureaus have kept weekly free reports available at AnnualCreditReport.com — the only federally authorized source. You're also entitled to a free report any time a creditor takes adverse action against you.

How long does the FCRA give the credit bureaus to investigate a dispute?

Section 611 generally requires the CRA to complete its investigation within 30 days of receiving your dispute. The window extends to 45 days if you submit additional documentation. If the bureau can't verify the disputed item, the FCRA requires it to be corrected or deleted.

Can the FCRA force a credit bureau to remove accurate negative information?

No. The FCRA only requires deletion of items that are inaccurate, incomplete, or unverifiable. Accurate negative items age off on their own statutory schedules — generally seven years for most late payments and collections, ten years for a Chapter 7 bankruptcy.

What can I do if a company violates my FCRA rights?

File a complaint with the CFPB at consumerfinance.gov/complaint and with the FTC at reportfraud.ftc.gov. The FCRA also gives consumers a private right of action — you can sue a CRA, furnisher, or user of consumer reports in state or federal court and recover actual damages, statutory damages, and attorney's fees.

The bottom line

The FCRA is one of the most useful consumer-protection statutes most people have never read. The 30-day dispute clock under § 611, the 7-year rule under § 605, and the permissible-purpose limits under § 604 turn most credit-reporting problems from a long argument into a documented process — when a bureau or furnisher pushes back, citing the right subsection is usually the difference between a brushoff and a result. If you'd rather hand the dispute work to a vetted company, (/#top-companies) on our independent reviews page.